CVE-2018-16878

A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS...

Linux: SGID files

When the SGID set group ID bit is set on an executable, it executes with the GID of the owner. This may be intended for some executables. Add files with SGID bit which should be allowed to have this bit set in the preference. This script checks if any other local files than the given have the SGI...

HackerOne: A small set of users were assigned someone else's payout preference

On December 20th, 2016, HackerOne introduced a new payout preference that allowed employee bounties to be paid through payroll. At the time, a feature was added to our support backend that allowed the IT department to provision this special payout preference for HackerOne employees. To help the I...

XSS in the labels widget gadget - CVE-2018-20232

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the rendering of retrieved content from a url location that could be...

XSS in the labels widget gadget - CVE-2018-20232

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the rendering of retrieved content from a url location that could be...

SMS Phishing + Cardless ATM = Profit

Thieves are combining SMS-based phishing attacks with new "cardless" ATMs to rapidly convert phished bank account credentials into cash. Recent arrests in Ohio shed light on how this scam works. A number of financial institutions are now offering cardless ATM transactions that allow customers to...

CVE-2018-5133

If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This...

Design/Logic Flaw

If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This...

CVE-2018-5133

If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This...

CVE-2018-5133

CVE-2018-5133 affects Firefox before 59, where a malicious local program can set the app.support.baseURL preference to HTML/script, which is not sanitized and can execute when loading chrome://browser/content/preferences/in-content/preferences.xul or when an EME CDM-disabled notification is shown...

CVE-2018-5133

If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2018-07086)

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. An information disclosure vulnerability exists in the 'app.support.baseURL' preference of Mozilla Firefox. A remote user can exploit the vulnerability by sending a specially crafted request to...

Security vulnerabilities fixed in Firefox 59 — Mozilla

A buffer overflow can occur when manipulating the SVG animatedPathSegList through script. This results in a potentially exploitable crash. A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations. This results in a potentially...

GLPI cross-site scripting vulnerability (CNVD-2018-06464)

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in GLPI 9.2.1 and prior...

UBUNTU-CVE-2018-7563

An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execute JavaScript code supplied by the attacker. The...

mcholste Enterprise Log Search and Archive Cross-Site Scripting Vulnerability

mcholste Enterprise Log Search and Archive ELSA is an enterprise log search and archive system. A cross-site scripting vulnerability exists in the index view in mcholste ELSA version 1205, commit 2cc17f1 and earlier. A remote attacker can leverage the 'type', 'name', and 'value' parameters in...

CVE-2018-1000029

mcholste Enterprise Log Search and Archive ELSA version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting XSS vulnerability in index view / that can result in . This attack appear to be exploitable via Payload delivered via the type, name, and value parameters of...

CVE-2018-1000029

mcholste Enterprise Log Search and Archive ELSA version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting XSS vulnerability in index view / that can result in . This attack appear to be exploitable via Payload delivered via the type, name, and value parameters of...

Updated flash-player-plugin packages fix security vulnerability

A regression affecting Adobe Flash Player version 27.0.0.187 and earlier versions causes the unintended reset of the global settings preference file when a user clears browser data. CVE-2017-11305...

Mark host as dead if going offline (failed ICMP ping) during scan - Phase 2

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...